fortigate-ipsec-40-mr3

IPsec VPN in the web-based manager
Local Gateway IP
P1 Proposal
DH Group
Keylife
If you selected Enable IPsec Interface Mode, specify an IP
address for the local end of the VPN tunnel. Select one of the
following:
Main Interface IP — The FortiGate unit obtains the IP address
of the interface from the network interface settings.
Specify — Enter a secondary address of the interface selected
in the phase 1 Local Interface field. For more information, see
“Local Interface” on page 27.
You cannot configure Interface mode in a transparent mode
VDOM.
Select the encryption and authentication algorithms used to
generate keys for protecting negotiations and add encryption and
authentication algorithms as required.
You need to select a minimum of one and a maximum of three
combinations. The remote peer or client must be configured to
use at least one of the proposals that you define.
Select one of the following symmetric-key encryption algorithms:
DES — Digital Encryption Standard, a 64-bit block algorithm
that uses a 56-bit key.
3DES — Triple-DES, in which plain text is encrypted three
times by three keys.
AES128 — a 128-bit block Cipher Block Chaining (CBC)
algorithm that uses a 128-bit key.
AES192 — a 128-bit block Cipher Block Chaining (CBC)
algorithm that uses a 192-bit key.
AES256 — a 128-bit block Cipher Block Chaining (CBC)
algorithm that uses a 256-bit key.
Select either of the following authentication message digests to
check the authenticity of messages during phase 1 negotiations:
MD5 — Message Digest 5, the hash algorithm developed by
RSA Data Security.
SHA1 — Secure Hash Algorithm 1, which produces a 160-bit
message digest.
SHA256 — Secure Hash Algorithm 2, which produces a 256bit
message digest.
To specify a third combination, use the Add button beside the
fields for the second combination.
Select one or more Diffie-Hellman groups from DH group 1, 2, 5
and 14. At least one of the DH Group settings on the remote peer
or client must match one the selections on the FortiGate unit.
Failure to match one or more DH groups will result in failed
negotiations.
Enter the time (in seconds) that must pass before the IKE
encryption key expires. When the key expires, a new key is
generated without interrupting service. The keylife can be from
120 to 172 800 seconds.
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 29
http://docs.fortinet.com/